id: smtp-credentials-exposure

info:
  name: SMTP Credentials Exposure - Detection
  author: pussycat0x
  severity: high
  description: |
    Detects exposed SMTP credentials (username and password) in a webpage's HTML or JavaScript source code.
  metadata:
    verified: true
    shodan-query: html:"smtp_password"
    max-request: 1
  tags: exposure,smtp,config,credentials

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, "smtp_username","smtp_password")
          - status_code == 200
        condition: and

    extractors:
      - type: regex
        part: body
        name: username
        group: 1
        regex:
          - smtp_username":"([^"]*)"
          - <smtp_username>(.*)</smtp_username>
        internal: true

      - type: regex
        part: body
        name: password
        group: 1
        regex:
          - smtp_password":"([^"]*)"
          - <smtp_password>(.*)</smtp_password>
        internal: true

      - type: dsl
        dsl:
          - '"Username: "+ username'
          - '"PASSWORD: "+ password'
# digest: 490a004630440220439ea70b44e9e86b7d67907d7d01b0763c265696ac93de0e19caf7d0b337ec450220181f77f6207f0746de22b3946abf376e251dc6771f5b03980dc8f64c669840c2:922c64590222798bb761d5b6d8e72950